2026

jsonwebtoken is a JWT lib in rust. Prior to version 10.3.0, there is a Type Confusion vulnerability in jsonwebtoken, spe

MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.10.0 to

JinJava is a Java-based template engine based on django template syntax, adapted to render jinja templates. Prior to ver

Magento-lts is a long-term support alternative to Magento Community Edition (CE). Prior to version 20.16.1, the admin ur

Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. In versions from 2.0.12 to

cert-manager adds certificates and certificate issuers as resource types in Kubernetes clusters, and simplifies the proc

A security vulnerability has been detected in WeKan up to 8.20. This affects the function setBoardOrgs of the file model

A weakness has been identified in ZenTao up to 21.7.6-85642. The impacted element is the function fetchHook of the file

IBM Concert 1.0.0 through 2.1.0 is vulnerable to HTTP header injection, caused by improper validation of input by the HO

IBM Concert 1.0.0 through 2.1.0 does not invalidate session after logout which could allow an authenticated user to impe

IBM Operations Analytics – Log Analysis versions 1.3.5.0 through 1.3.8.3 and IBM SmartCloud Analytics – Log Analysis are

OpenSlides is a free, web based presentation and assembly system for managing and projecting agenda, motions and electio

Wagtail is an open source content management system built on Django. Prior to versions 6.3.6, 7.0.4, 7.1.3, 7.2.2, and 7

Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.150, 25.0.82, a

Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.150, 25.0.82, a

Terraform / OpenTofu Provider adds support for Proxmox Virtual Environment. Prior to version 0.93.1, in the SSH configur

XML Injection (aka Blind XPath Injection) vulnerability in Drupal Central Authentication System (CAS) Server allows Priv

Incorrect Authorization vulnerability in Drupal Drupal Canvas allows Forceful Browsing.This issue affects Drupal Canvas:

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Microsoft Entra ID SSO Login allows Pri

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AT Internet

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AT Internet

Privilege Defined With Unsafe Actions vulnerability in Drupal Role Delegation allows Privilege Escalation.This issue aff

Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Group invite allows Forceful Browsing.This

IBM Jazz Reporting Service could allow an authenticated user on the network to affect the system's performance using com

IBM Jazz Reporting Service could allow an authenticated user on the host network to obtain sensitive information about o

IBM Jazz Reporting Service could allow an authenticated user on the host network to cause a denial of service using spec

A security flaw has been discovered in Open5GS up to 2.7.6. Affected by this vulnerability is the function hss_ogs_diam_

IBM Common Cryptographic Architecture (CCA) 7.5.52 and 8.4.82 could allow an unauthenticated user to execute arbitrary c

IBM Db2 Big SQL on Cloud Pak for Data versions 7.6 (on CP4D 4.8), 7.7 (on CP4D 5.0), and 7.8 (on CP4D 5.1) do not proper

IBM Cloud Pak System does not set the secure attribute on authorization tokens or session cookies. Attackers may be able

IBM Cloud Pak System is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScrip

IBM Cloud Pak System displays sensitive information in user messages that could aid in further attacks against the syste

FacturaScripts is open-source enterprise resource planning and accounting software. Prior to version 2025.81, FacturaScr

FacturaScripts is open-source enterprise resource planning and accounting software. Prior to version 2025.81, FacturaScr

Bambuddy is a self-hosted print archive and management system for Bambu Lab 3D printers. Prior to version 0.1.7, a hardc

Langroid is a framework for building large-language-model-powered applications. Prior to version 0.59.32, there is a byp

OpenClaw is a personal AI assistant. Prior to version 2026.1.30, the isValidMedia() function in src/media/parse.ts allow

Alist is a file list program that supports multiple storages, powered by Gin and Solidjs. Prior to version 3.57.0, the a

Alist is a file list program that supports multiple storages, powered by Gin and Solidjs. Prior to version 3.57.0, the a

OpenClaw is a personal AI assistant. Prior to version 2026.1.29, there is an OS command injection vulnerability via the

melange allows users to build apk packages using declarative pipelines. From version 0.14.0 to before 0.40.3, an attacke

melange allows users to build apk packages using declarative pipelines. From version 0.10.0 to before 0.40.3, an attacke

Compressing is a compressing and uncompressing lib for node. In version 2.0.0 and 1.10.3 and prior, Compressing extracts

melange allows users to build apk packages using declarative pipelines. From version 0.3.0 to before 0.40.3, an attacker

melange allows users to build apk packages using declarative pipelines. In version 0.11.3 to before 0.40.3, an attacker

Apollo Server is an open-source, spec-compliant GraphQL server that's compatible with any GraphQL client, including Apol

Water-Melon Melon commit 9df9292 and below is vulnerable to Denial of Service. The HTTP component doesn't have any maxim

NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. In version 0.24.6, NanoMQ has a protocol parsing /

apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before 1.1.1

apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before 1.1.0